How to edit biography using php? - php

Question

I am trying to allow users to edit their biography and on the page I want the editable text from the DB to appear in the text box. How do I do this? Currently I have the text as a placeholder, but I want to make that editable.
Also for other, shorter fields like a users company name, when I insert the value as the placeholder (I don't want it to be editable like the bio so it doesn't resubmit every time), it can't display more than one word. How can I fix this.
Note: I wrote a function that only displays a value from SQL if there is one, else it displays a generic text, i.e. "bio" or "email"
Here is my function where $content is something like $_POST["bio"] and
<?php
function echo_content($content,$name)
{
if(!empty($content)){
echo($content);
}
else{
echo($name);
}
}
?>
Below is my html/php where $content is a value from SQL.
<div class="form-group">
<legend>Bio: </legend><textarea rows="4" cols="50" class="form-control" name="bio"
placeholder=<?php echo_content($content[0]["bio"],"Bio");?> type="text"/></textarea>
</div>

Answer 1

You're dumping a string into an html attribute, WITHOUT quotes, so basically you're producing:
<textarea ... placeholder=Four Score and Seven Years ago type="text">
so your placeholder is Four, and then there's a bunch of unknown/illegal attributes, Score, and, Seven etc...
Try
<textarea ... placeholder="<?php echo htmlspecialchars($var) ?>" ...>
instead. note the " and use of htmlspecialchars() to quote out html metachars.
In other words, you're basically suffering from a self-inflicted HTML injection wound.